December 2011 - DG-AM - mailman.kantarainitiative.org

Notes from breakout session regarding attributes from the Mapping the Identity Ecosystem workshop
by Heather Flanagan 04 Jan '12

04 Jan '12

Who is interested in attributes? - Notes from the ISOC Identity Ecosystem Working Group Open Groups defining standards / schemas / frameworks OIX Attribute Exchange: only having its first meeting this week . IETF: ABFAB. MACE-DIR / eduperson / SHAC. More closed defining standards / schemas / frameworks ITU SG 17 U10: open to liaison with experts on board and open to members. ISO. These are possibly at a higher level than attribute schema. Discussion / implementation groups: Kantara Attribute Discussion Group. REFEDS Attribute Release. Other. SCIM. eID initiatives. Problem areas Sharing across the groups it is difficult to share across where information is closed off by non-release before final / copyright / behind closed doors. The earlier in the process you share work, the easier interoperability is later. Where is convergence? How are we ensuring that the correct feedback is being created when outputs / schemas / proposals are coming out of these groups? Is Kantara the feature for this? Solutions: making John Bradley be the lynch-pin. use existing discussion groups – Kantara is the obvious place. Go out to all the places having discussions – unscaleable. What is the “internet of things” attribute schema? MIBS (++). Attributes of things as well as attributes of people. Devices – as identity consumers as well as having identities themselves. Is device identity more a projection of personal identity? Too much, too many, too patchy. Collision-resistant namespaces - the OpenID Connect approach. Solutions: A simple way to design attribute schema. Attribute registry? Things that don’t assume that there will be one of every type. Agreement around extensibility. IANA? Context provider – in what context can I use this context? Where does the conversation about this happen? Who operates an attribute registry? We need real participants who will benefit from this. Fostering Implementation Developing the business case, putting time and effort in to adoption of what we have now. Discussions to be had around what is the right scope to put around the structure of attributes – filtering, flexibility, assertion. Solutions: ???? Unclear spaces Language code – still not a coherent way to express preferred language. Solutions: write up an RFC on problematic points? OVERALL ACTION: Give these notes to OIX and Kantara

2 1

Happy Holidays
by Salvatore D'Agostino 23 Dec '11

23 Dec '11

1 0

Notes from DG-AM call, 2011-12-20
by Heather Flanagan 21 Dec '11

21 Dec '11

Hi all - The notes from the Attribute Management call are up on the wiki. http://kantarainitiative.org/confluence/display/AMDG/AMDG+Notes+2011-12-20 As a quick highlight, the following new action items are assigned: * 20111220-01: Keith: send notes on discussion of the Mapping workshop from the Internet2 MACE-Dir call * 20111220-02: Heather: add notes from the workshop breakout session on attributes to the wiki * 20111220-03: Sal: update Current Industry Efforts to the OIX attribute working group and the OASIS trust elevation group * 20111220-04: Keith: add a link to the Internet2/Kuali-Rice/registry group working on a data model to Current Industry Efforts * 20111220-05: Sal: have an attribute gap session at IIW in January and report back * 20111220-06: Sal: report back on the "13+3" DOD attributes * 20111220-07: Heather: have initial discussion group report ready by February 14 call We will have a call January 3, 2012, using new dial-in information. A brief agenda and dial-in logistics will be published before the call. Happy holidays, everyone! -Heather

1 1

REMINDER & AGENDA: DGAM Telecon Tuesday 20 December 2011 11h PT / 14h ET / 19h UTC
by Heather Flanagan 19 Dec '11

19 Dec '11

DIAL-IN: Skype: +9900827042954214 (Note that this number will change January 1, 2012!!) US Dial-In: +1-201-793-9022 | Room Code: 4630912 DATE: Tuesday, 20 December / 2011 TIME: 11h PT / 14h ET / 19h UTC AGENDA: 1. Administrative a. Roll Call b. New member introduction c. Motion for minutes approval: Minutes 2011-12-06 2011-11-08 (Do we want to do this as DG? It is not required) d. Agenda confirmation e. Action item review i. 20111108-04: all: to review the eGov requirements and see what information can be used/discussed at next call, Colin to send link ii. 20111206-01: Keith to add links to Social2SAML iii. 20111206-02: Heather to report on Mapping the Identity Ecosystem workshop, Amsterdam iv. 20111206-03: Colin to provide liaison with OASIS Trust Elevation f. 90 Day deliverable i. Identify gaps in attribute landscape, 2. Discussion Topics a. Mapping attributes to providers where the don’t match (Identify attributes mismatches) i. content difference ii. name difference b. Social2SAML gap 3. AOB

1 0

Updated Current Industry Efforts
by Salvatore D'Agostino 14 Dec '11

14 Dec '11

DGAM, I added the schema comparison from the Simple Cloud Identity Management group, pretty useful imo. http://kantarainitiative.org/confluence/display/AMDG/Current+Industry+Effort s Happy holidays, Sal Salvatore D'Agostino, CSCIP IDmachines LLC |1264 Beacon Street, #5 | Brookline, MA 02446 | USA http:\\www.idmachines.com <http://www.idmachines.com/> | http:\\idmachines.blogspot.com <http://idmachines.blogspot.com/> | @idmachines +1 617.201.4809 ph | +1 617.812.6495 fax

1 0

FW: SAML Binding for SCIM revisited
by Salvatore D'Agostino 07 Dec '11

07 Dec '11

FYI an attribute discussion related to cloud identity From: cloud-directory(a)googlegroups.com [mailto:cloud-directory@googlegroups.com] On Behalf Of Paul Madsen Sent: Wednesday, December 07, 2011 9:24 AM To: cloud-directory(a)googlegroups.com Subject: Re: SAML Binding for SCIM revisited I raised the issue (and proposal) on the SSTC SAML list and there was 'push back' from Scott Cantor and others as to SCIM imposing a new set of attribute names for SAML, as opposed to reusing existing SAML Attribute profiles, eg . eduPerson's homePostalAddress and corresponding SAML Attribute. FWIW, I agree with the general premise that a binding of SCIM to SAML should, where possible, leverage existing SAML constructs. It would be (theoretically) possible for the SAML Binding for SCIM to simply consist of a table of SCIM attributes and corresponding pre-existing SAML attribute names. Thoughts on this alternative? paul On 12/5/11 12:37 PM, Paul Madsen wrote: In looking at the SAML binding more closely, the limitations of the existing model have become apparent. Fundamentally, trying to map complex structures into flat attributes is difficult. In discussions with colleagues Brian & Travis, we've come up with a proposal that seems to serve. Specifically, the proposal is to use an 'XPath-ish' syntax to represent the position of a given SAML attribute within a notional SCIM XML representation - this XPath expression inserted into the SAML Attribute Name. Below are examples of SAML attributes for the different types of SCIM attributes - distinguished by simple/complex & single/multi-value to cover the full SCIM continuum of complexity The SAML Attribute NameFormat value is the namespace URN for the corresponding SCIM attribute, either SCIM or relevant extension. Thoughts? paul -----------------------------------------------  <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="externalId"> <saml:AttributeValue xsi:type="xs:string">701984</saml:AttributeValue> </saml:Attribute>  <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="name/formatted"> <saml:AttributeValue xsi:type="xs:string">Ms. Babs J Jensen III</saml:AttributeValue> </saml:Attribute>  <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="emails/email[@type='work'&primary='true']"> <saml:AttributeValue xsi:type="xs:string">bjensen(a)example.com</saml:AttributeValue> </saml:Attribute> <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="emails/email[@type='home']"> <saml:AttributeValue xsi:type="xs:string">babs(a)jensen.com</saml:AttributeValue> </saml:Attribute>  <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="addresses/address[@type='work'&primary='true']/formatted"> <saml:AttributeValue xsi:type="xs:string">100 Universal City Plaza, Hollywood, CA 91608 USA</saml:AttributeValue> </saml:Attribute> <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="addresses/address[@type='work'&primary='true']/streetAddress"> <saml:AttributeValue xsi:type="xs:string">100 Universal City Plaza</saml:AttributeValue> </saml:Attribute> <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="addresses/address[@type='home']/formatted"> <saml:AttributeValue xsi:type="xs:string">456 Hollywood Blvd, Hollywood, CA 91608 USA</saml:AttributeValue> </saml:Attribute> <saml:Attribute NameFormat="urn:scim:schemas:core:1.0" Name="addresses/address[@type='home']/streetAddress"> <saml:AttributeValue xsi:type="xs:string">456 Hollywood Blvd</saml:AttributeValue> </saml:Attribute>  <saml:Attribute NameFormat="urn:scim:schemas:extension:enterprise:1.0" Name="employeeNumber"> <saml:AttributeValue xsi:type="xs:string">701984</saml:AttributeValue> </saml:Attribute>

1 0

DRAFT notes and AI from today's call
by Heather Flanagan 07 Dec '11

07 Dec '11

Hi everyone - A draft version of the notes from today's call are available online: http://kantarainitiative.org/confluence/display/AMDG/AMDG+Notes+2011-12-06 New action items: 20111206-01: Colin to send out link or doc to Rackish Radakrishn's doc on attributes -> token conversion 20111206-02: Keith to add additional links regarding Social2SAML gateways on the wiki 20111206-03: Heather will report back from Mapping the Identity Ecosystem workshop which will occur Dec 14-15 in Amsterdam 20111206-04: Colin to take this support of collaboration between DG-AM and the OASIS Trust Elevation working group back to the OASIS

2 1

Re: [DG-AM] Stuck in the queue? REMINDER & AGENDA!! DGAM Telecon Tuesday 6 December 2011 11h PT / 14h ET / 19h UTC
by Keith Hazelton 06 Dec '11

06 Dec '11

I can't figure out what's happening to mail sent to me from the dg-am list, but I'm not seeing it. I just applied to join the group separately under khazelton(a)gmail.com. Could someone approve that, please? Puzzled, --Keith _____________________ On Dec 6, 2011, at 12:32, Heather Flanagan wrote: > Hi Keith - > > I saw it come out. Wasn't entirely sure why you sent it since I forwarded the agenda out yesterday, but I did see it. :-) > > ----- Original Message ----- > From: "Keith Hazelton" <hazelton(a)doit.wisc.edu> > To: "Heather Flanagan" <hlflanagan(a)internet2.edu>, "Salvatore D'Agostino" <sal(a)idmachines.com>, "Anna Ticktin" <annaticktin(a)me.com> > Sent: Tuesday, December 6, 2011 10:29:15 AM > Subject: Stuck in the queue? REMINDER & AGENDA!! DGAM Telecon Tuesday 6 December 2011 11h PT / 14h ET / 19h UTC > > > > > I send this 5 minutes ago to our AMDG mailing list. Haven't seen it come out yet..... --Keith > ___________ > DIAL-IN: > > > > LINE B > > > Skype: +9900827042954214 > > US Dial-In: +1-201-793-9022 | Room Code: 4630912 > > > > DATE: > > Tuesday, 6 December / 2011 > > > > TIME: > > 11h PT / 14h ET / 19h UTC > > > > > > AGENDA: > > > > > > 1. Administrative: > > > > Roll Call > > New member introduction > > > > Motion for minutes approval: Minutes 2011-11-08 > > > > Agenda confirmation > > > > Action item review : > > > 20111108-01: all: review Account Linking doc and provide feedback by next call* > 20111108-02: Keith: Move Attribute Aggregation use case up to VO section* > 20111108-03: Sal: Sal to post the PIV2SAML items to the use case repository* > 20111108-04: all: to review the eGov requirements and see what information can be used/discussed at next call > 20111108-05: Sal: reach out to the background check industry to see if they are willing to participate in the DG-AM > > > > 2. 90 Day deliverable – Identify gaps in attribute landscape > i. Mapping attributes to providers where the don’t match > (Identify attributes mismatches) > a. content difference > b. name difference > > > > > 3. OASIS Trust Elevation > > 4. AOB > > > > Adjourn > > > > —> Anna Ticktin > > Technical Program Coordinator > anna(a)kantarainitiative.org > anna(a)ieee-isto.org

4 3

REMINDER & AGENDA!! DGAM Telecon Tuesday 6 December 2011 11h PT / 14h ET / 19h UTC
by Keith Hazelton 06 Dec '11

06 Dec '11

DIAL-IN: LINE B Skype: +9900827042954214 US Dial-In: +1-201-793-9022 | Room Code: 4630912 DATE: Tuesday, 6 December / 2011 TIME: 11h PT / 14h ET / 19h UTC AGENDA: 1. Administrative: Roll Call New member introduction Motion for minutes approval: Minutes 2011-11-08 Agenda confirmation Action item review: 20111108-01: all: review Account Linking doc and provide feedback by next call* 20111108-02: Keith: Move Attribute Aggregation use case up to VO section* 20111108-03: Sal: Sal to post the PIV2SAML items to the use case repository* 20111108-04: all: to review the eGov requirements and see what information can be used/discussed at next call 20111108-05: Sal: reach out to the background check industry to see if they are willing to participate in the DG-AM 2. 90 Day deliverable – Identify gaps in attribute landscape i. Mapping attributes to providers where the don’t match (Identify attributes mismatches) a. content difference b. name difference 3. OASIS Trust Elevation 4. AOB Adjourn —> Anna Ticktin Technical Program Coordinator anna(a)kantarainitiative.org anna(a)ieee-isto.org

1 0

REMINDER & AGENDA!! DGAM Telecon Tuesday 6 December 2011 11h PT / 14h ET / 19h UTC
by Heather Flanagan 05 Dec '11

05 Dec '11

DIAL-IN: Skype: +9900827042954214 US Dial-In: +1-201-793-9022 | Room Code: 4630912 DATE: Tuesday, 6 December / 2011 TIME: 11h PT / 14h ET / 19h UTC AGENDA: 1. Administrative: Roll Call New member introduction Motion for minutes approval: Minutes 2011-11-08 Agenda confirmation Action item review: 20111108-01: all: review Account Linking doc and provide feedback by next call* 20111108-02: Keith: Move Attribute Aggregation use case up to VO section* 20111108-03: Sal: Sal to post the PIV2SAML items to the use case repository* 20111108-04: all: to review the eGov requirements and see what information can be used/discussed at next call 20111108-05: Sal: reach out to the background check industry to see if they are willing to participate in the DG-AM 2. 90 Day deliverable – Identify gaps in attribute landscape i. Mapping attributes to providers where the don’t match (Identify attributes mismatches) a. content difference b. name difference 3. OASIS Trust Elevation 4. AOB Adjourn

1 0